Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-71321
Picklescan vulnerable to Arbitrary File Writing
HIGH
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
HIGH
CVE-2025-68696
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
HIGH
CVE-2025-51511
Cadmium CMS has a background arbitrary file upload vulnerability
HIGH
CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
HIGH
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
HIGH
CVE-2025-14443
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References
HIGH
CVE-2025-11393
Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access
HIGH
CVE-2025-66001
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
HIGH
CVE-2025-67779
Denial of Service Vulnerability in React Server Components
HIGH
CVE-2025-26866
Apache HugeGraph-Server: RAFT and deserialization vulnerability
HIGH
CVE-2025-55184
Denial of Service Vulnerability in React Server Components
HIGH
CVE-2025-66628
ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
HIGH
CVE-2025-66474
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
HIGH
CVE-2025-8110KEV
Gogs vulnerable to a bypass of CVE-2024-55947
HIGH
CVE-2025-66626
RCE via ZipSlip and symbolic links in argoproj/argo-workflows
HIGH
CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
HIGH
CVE-2026-29067
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login
HIGH
CVE-2025-66631
Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)
HIGH
CVE-2025-66627
Critical Use-After-Free in Wasmi's Linear Memory
HIGH
GHSA-2cgv-28vr-rv6j
libcrux incorrectly calculates on aarch64
HIGH
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
HIGH
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
HIGH
CVE-2025-64443
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode
HIGH
CVE-2025-66468
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
HIGH
CVE-2025-13827
GrapesJsBuilder File Upload allows all file uploads
HIGH
CVE-2025-13353
gokey allows secret recovery from a seed file without the master password
HIGH
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
HIGH
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
HIGH
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
HIGH
CVE-2025-12060
Keras Directory Traversal Vulnerability
HIGH
CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
HIGH
CVE-2025-66299
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
HIGH
CVE-2025-66296
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
HIGH
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
HIGH
CVE-2025-12183
LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS
HIGH
CVE-2025-66035
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
HIGH
CVE-2025-65966
OneUptime Unauthorized User Creation via API
HIGH
CVE-2025-66017
cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures
HIGH
CVE-2025-58360KEV
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
HIGH
CVE-2025-65947
thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS
HIGH
CVE-2025-65109
Minder does not sandbox http.send in Rego programs
HIGH
CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
HIGH
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
HIGH
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
HIGH
CVE-2025-64523
File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function
HIGH
CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
HIGH
CVE-2025-64507
Incus vulnerable to local privilege escalation through custom storage volumes
HIGH
CVE-2025-64500EPSS 0.0%
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
HIGH
CVE-2025-64186
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves